1 1 00:00:00,300 --> 00:00:02,160 Malware analysis. 2 2 00:00:02,160 --> 00:00:03,150 In this lesson, 3 3 00:00:03,150 --> 00:00:05,970 I'm going to do a little bit of static and dynamic malware 4 4 00:00:05,970 --> 00:00:08,730 analysis and then we're going to go through and look at how we 5 5 00:00:08,730 --> 00:00:10,980 can look through a debugger and decompiler 6 6 00:00:10,980 --> 00:00:12,840 to analyze some of the code. 7 7 00:00:12,840 --> 00:00:14,550 Now, again, stick with me here. 8 8 00:00:14,550 --> 00:00:16,260 You don't have to actually be able to do 9 9 00:00:16,260 --> 00:00:18,300 all the things I'm going to show you here. 10 10 00:00:18,300 --> 00:00:20,040 This is just to give you an introduction to some of the 11 11 00:00:20,040 --> 00:00:23,310 tools and techniques that reverse engineers use. 12 12 00:00:23,310 --> 00:00:25,320 Let's go ahead and get started. 13 13 00:00:25,320 --> 00:00:27,690 Now, the first thing we're going to do before trying 14 14 00:00:27,690 --> 00:00:31,020 dynamic analysis is go and look at it statically. 15 15 00:00:31,020 --> 00:00:32,580 And so we're going to open up a command prompt. 16 16 00:00:32,580 --> 00:00:35,820 So click on your Windows icon and type in the word command. 17 17 00:00:35,820 --> 00:00:37,230 And from the command prompt, 18 18 00:00:37,230 --> 00:00:40,350 we want to change directories into the desktop. 19 19 00:00:40,350 --> 00:00:41,340 And if you notice here, 20 20 00:00:41,340 --> 00:00:43,770 we do have Trickster on the desktop. 21 21 00:00:43,770 --> 00:00:46,050 Now, we need to extract Trickster. 22 22 00:00:46,050 --> 00:00:48,870 So we're going to right-click it, go to 7Zip, 23 23 00:00:48,870 --> 00:00:51,120 and go to extract here. 24 24 00:00:51,120 --> 00:00:52,740 It's going to ask us for the password 25 25 00:00:52,740 --> 00:00:56,070 and the password is malware123. 26 26 00:00:56,070 --> 00:00:57,990 We've password protected this to make sure you don't 27 27 00:00:57,990 --> 00:01:01,380 accidentally unzip it on a system you don't want to. 28 28 00:01:01,380 --> 00:01:02,213 So in this case, 29 29 00:01:02,213 --> 00:01:04,440 we're going to go ahead and hit okay and you'll now see 30 30 00:01:04,440 --> 00:01:06,410 Trickster is there on the desktop. 31 31 00:01:06,410 --> 00:01:10,500 If we hit DIR again, you'll see there it is. 32 32 00:01:10,500 --> 00:01:12,870 So what we want to do is pull out 33 33 00:01:12,870 --> 00:01:15,030 any ASCII strings inside that 34 34 00:01:15,030 --> 00:01:18,240 binary by going through a program called Floss, 35 35 00:01:18,240 --> 00:01:20,700 and it's F-L-O-S-S. 36 36 00:01:20,700 --> 00:01:22,830 And then the name of the file you want it to search through, 37 37 00:01:22,830 --> 00:01:25,050 which will be trickster.exe. 38 38 00:01:25,050 --> 00:01:27,840 And we're going to pipe that into a text file called 39 39 00:01:27,840 --> 00:01:32,670 trickster_strings.txt. 40 40 00:01:32,670 --> 00:01:34,620 That's going to go through that entire file, 41 41 00:01:34,620 --> 00:01:37,680 find anything that looks like an ASCII character 42 42 00:01:37,680 --> 00:01:39,060 text that we can read, 43 43 00:01:39,060 --> 00:01:41,250 and put it into a file for us to review. 44 44 00:01:41,250 --> 00:01:42,120 So to look at that, 45 45 00:01:42,120 --> 00:01:45,583 we're just going to use type and then tricksterstrings.txt 46 46 00:01:47,670 --> 00:01:51,780 and then the command more to see it a page at a time. 47 47 00:01:51,780 --> 00:01:54,180 Now notice here it says there's a comment. 48 48 00:01:54,180 --> 00:01:56,490 This program cannot be run in DOS. 49 49 00:01:56,490 --> 00:01:57,480 That's fine. 50 50 00:01:57,480 --> 00:01:58,830 And then it's going to start outputting 51 51 00:01:58,830 --> 00:02:00,930 any ASCII characters it finds. 52 52 00:02:00,930 --> 00:02:03,750 And then you can see here it found 2W3, 53 53 00:02:03,750 --> 00:02:08,160 it found this garbage, it found .text, .rdata, .data, 54 54 00:02:08,160 --> 00:02:09,780 and then a whole bunch of stuff 55 55 00:02:09,780 --> 00:02:12,210 that just looks kind of encrypted. 56 56 00:02:12,210 --> 00:02:14,160 And if I go a couple more pages here, 57 57 00:02:14,160 --> 00:02:16,560 you're going to see there's a lot of content 58 58 00:02:16,560 --> 00:02:17,880 that I just can't read. 59 59 00:02:17,880 --> 00:02:19,650 It doesn't make any sense. 60 60 00:02:19,650 --> 00:02:21,540 What is all this data here? 61 61 00:02:21,540 --> 00:02:24,210 Well, what I'm really looking for is IP addresses. 62 62 00:02:24,210 --> 00:02:25,950 I'm looking for host names. 63 63 00:02:25,950 --> 00:02:28,860 I'm looking for email addresses or program file names 64 64 00:02:28,860 --> 00:02:30,240 or anything like that. 65 65 00:02:30,240 --> 00:02:31,710 But in the case of Trickster, 66 66 00:02:31,710 --> 00:02:34,080 all I'm finding is a garbled mess. 67 67 00:02:34,080 --> 00:02:36,270 That indicates that this malware 68 68 00:02:36,270 --> 00:02:39,780 has been protected using encryption to keep people 69 69 00:02:39,780 --> 00:02:41,700 like us trying to do malware analysis 70 70 00:02:41,700 --> 00:02:43,950 from detecting its true source. 71 71 00:02:43,950 --> 00:02:47,070 And that means that static analysis here isn't going to work 72 72 00:02:47,070 --> 00:02:49,830 real well because it's all encrypted. 73 73 00:02:49,830 --> 00:02:52,020 Okay, so Trickster was encrypted 74 74 00:02:52,020 --> 00:02:53,820 and we couldn't do static analysis, 75 75 00:02:53,820 --> 00:02:55,200 but here's where it gets fun. 76 76 00:02:55,200 --> 00:02:57,510 We're going to look at this thing dynamically. 77 77 00:02:57,510 --> 00:02:59,910 We're going to start running the program and try to identify 78 78 00:02:59,910 --> 00:03:02,610 its purpose and what the file does. 79 79 00:03:02,610 --> 00:03:03,480 We're going to try to figure out what 80 80 00:03:03,480 --> 00:03:05,100 the malware does to the system. 81 81 00:03:05,100 --> 00:03:06,390 What changes does it make? 82 82 00:03:06,390 --> 00:03:08,100 Does it call out to a remote website? 83 83 00:03:08,100 --> 00:03:09,840 Does it download files? 84 84 00:03:09,840 --> 00:03:11,820 Does it mess up your registry? 85 85 00:03:11,820 --> 00:03:13,260 What is it going to do? 86 86 00:03:13,260 --> 00:03:15,420 Well, we're going to figure that out here. 87 87 00:03:15,420 --> 00:03:18,450 So, the first thing we want to do here is we want to create 88 88 00:03:18,450 --> 00:03:20,970 a known good baseline of our system. 89 89 00:03:20,970 --> 00:03:22,230 What I want to figure out is, 90 90 00:03:22,230 --> 00:03:23,970 what does the registry look like? 91 91 00:03:23,970 --> 00:03:25,890 What does the task manager look like? 92 92 00:03:25,890 --> 00:03:27,870 What does the schedule task look like? 93 93 00:03:27,870 --> 00:03:29,610 All of those type of details. 94 94 00:03:29,610 --> 00:03:30,510 And to do that, 95 95 00:03:30,510 --> 00:03:34,800 we can use a program from system internals called Auto Runs, 96 96 00:03:34,800 --> 00:03:38,490 A-U-T-O-R-U-N-S, Auto Runs. 97 97 00:03:38,490 --> 00:03:40,260 Just go ahead and enter it from your command prompt and hit 98 98 00:03:40,260 --> 00:03:41,947 enter and the program will launch for you. 99 99 00:03:41,947 --> 00:03:46,320 I'm going to go ahead and maximize it here and I'm going to go 100 100 00:03:46,320 --> 00:03:48,240 ahead and go to file and there's 101 101 00:03:48,240 --> 00:03:50,790 a setting called run as administrator. 102 102 00:03:50,790 --> 00:03:53,820 I want to do that so that system internals and Auto Runs can 103 103 00:03:53,820 --> 00:03:57,960 see the entire system regardless of what user it is. 104 104 00:03:57,960 --> 00:03:59,940 And so we're going to let it run here for a second. 105 105 00:03:59,940 --> 00:04:01,530 It'll take about 30 seconds. 106 106 00:04:01,530 --> 00:04:02,430 And when it's done, 107 107 00:04:02,430 --> 00:04:05,160 it's going to say ready in the bottom left corner, 108 108 00:04:05,160 --> 00:04:06,510 as it just did. 109 109 00:04:06,510 --> 00:04:08,700 This is the baseline. 110 110 00:04:08,700 --> 00:04:11,970 This is a system that is not infected with malware. 111 111 00:04:11,970 --> 00:04:13,860 Nothing bad has happened yet. 112 112 00:04:13,860 --> 00:04:17,133 So what we want to do is go to file and save this. 113 113 00:04:18,150 --> 00:04:20,880 And I'm going to save this to the desktop 114 114 00:04:20,880 --> 00:04:22,743 and I'm going to call it baseline. 115 115 00:04:25,080 --> 00:04:26,073 Go ahead and save. 116 116 00:04:27,510 --> 00:04:29,430 And you'll see that it does show up here 117 117 00:04:29,430 --> 00:04:34,430 on my desktop right there, baseline.autorun file. 118 118 00:04:34,710 --> 00:04:37,080 Now, what do we want to do next? 119 119 00:04:37,080 --> 00:04:39,720 Well, we want to run Trickster 120 120 00:04:39,720 --> 00:04:41,700 and we want to run it as an administrator. 121 121 00:04:41,700 --> 00:04:43,020 So we're going to right-click it and say 122 122 00:04:43,020 --> 00:04:46,440 run as administrator and infect this machine. 123 123 00:04:46,440 --> 00:04:49,590 Go ahead and hit yes, give it a second here, 124 124 00:04:49,590 --> 00:04:51,750 and Trickster will run and start 125 125 00:04:51,750 --> 00:04:53,610 doing whatever it does to our machine, 126 126 00:04:53,610 --> 00:04:55,470 which we don't know what it does yet. 127 127 00:04:55,470 --> 00:04:57,030 But we can find that out. 128 128 00:04:57,030 --> 00:05:00,600 So what we're going to do is maximize our Auto Runs again. 129 129 00:05:00,600 --> 00:05:04,320 Go over here to the refresh button and hit refresh. 130 130 00:05:04,320 --> 00:05:07,560 It's going to scan your system again and figure out what does 131 131 00:05:07,560 --> 00:05:09,810 an infected system look like. 132 132 00:05:09,810 --> 00:05:11,940 So, now that it's done and it's ready, 133 133 00:05:11,940 --> 00:05:14,580 we're going to go up to file and compare it 134 134 00:05:14,580 --> 00:05:19,320 to our known good baseline, that baseline.arn file. 135 135 00:05:19,320 --> 00:05:21,840 And all this is going to do is take what the current system 136 136 00:05:21,840 --> 00:05:24,000 found and then take away anything 137 137 00:05:24,000 --> 00:05:26,850 that was in the old baseline system. 138 138 00:05:26,850 --> 00:05:29,520 And whatever's left is what Trickster did. 139 139 00:05:29,520 --> 00:05:33,000 So if we go ahead and hit open, we have one thing. 140 140 00:05:33,000 --> 00:05:37,470 All Trickster did when it ran was added a task scheduler, 141 141 00:05:37,470 --> 00:05:40,380 and it has one called services update, 142 142 00:05:40,380 --> 00:05:42,750 and the file that it's telling it to run is this 143 143 00:05:42,750 --> 00:05:47,497 users/ieuser/appdata/roaming/winappusjdltufs.exe. 144 144 00:05:51,810 --> 00:05:52,863 Now, as I talk about this file, 145 145 00:05:52,863 --> 00:05:54,810 when we go through our analysis, 146 146 00:05:54,810 --> 00:05:57,840 I'm going to refer to it as u.exe because 147 147 00:05:57,840 --> 00:06:02,160 I don't want to have to keep saying USJDLTUFS 148 148 00:06:02,160 --> 00:06:04,590 because that's just a really, long weird name. 149 149 00:06:04,590 --> 00:06:07,260 So anyway, we see here that this was a change 150 150 00:06:07,260 --> 00:06:08,790 to the task scheduler. 151 151 00:06:08,790 --> 00:06:10,200 It didn't touch the registry, 152 152 00:06:10,200 --> 00:06:12,720 it didn't touch the file system with the exception of 153 153 00:06:12,720 --> 00:06:15,390 putting this one file here in this path 154 154 00:06:15,390 --> 00:06:18,210 and it's being run through the task scheduler. 155 155 00:06:18,210 --> 00:06:20,040 So, to look further into it, 156 156 00:06:20,040 --> 00:06:22,170 we're going to go into our task scheduler. 157 157 00:06:22,170 --> 00:06:25,230 So let's go ahead and open up our task scheduler by clicking 158 158 00:06:25,230 --> 00:06:29,520 on the Windows icon and typing in task scheduler. 159 159 00:06:29,520 --> 00:06:30,540 And there it is. 160 160 00:06:30,540 --> 00:06:31,590 Go ahead and open it. 161 161 00:06:32,430 --> 00:06:34,170 We'll maximize this here. 162 162 00:06:34,170 --> 00:06:38,310 And you can see that task name services update is showing up 163 163 00:06:38,310 --> 00:06:41,670 here and it's set to run at 5:03 PM, 164 164 00:06:41,670 --> 00:06:43,860 which is in about three minutes from now. 165 165 00:06:43,860 --> 00:06:46,170 And it has multiple triggers defined. 166 166 00:06:46,170 --> 00:06:47,640 So let's go ahead and look at these triggers 167 167 00:06:47,640 --> 00:06:49,743 and figure out what does this file do. 168 168 00:06:51,000 --> 00:06:52,200 So if I double-click on it, 169 169 00:06:52,200 --> 00:06:53,610 it will open up and you'll see that 170 170 00:06:53,610 --> 00:06:55,650 the nameless services update. 171 171 00:06:55,650 --> 00:06:59,070 You'll see the description is look for services monitor, 172 172 00:06:59,070 --> 00:07:02,220 which doesn't really make much sense in English, 173 173 00:07:02,220 --> 00:07:03,960 so that tells me that this may also 174 174 00:07:03,960 --> 00:07:06,510 be not a legitimate program. 175 175 00:07:06,510 --> 00:07:09,360 Now, let's go ahead and look at triggers. 176 176 00:07:09,360 --> 00:07:11,520 Under triggers, there are two triggers. 177 177 00:07:11,520 --> 00:07:13,950 Anytime somebody logs on the system, 178 178 00:07:13,950 --> 00:07:16,500 this task is going to be run and then 179 179 00:07:16,500 --> 00:07:19,800 it's going to happen daily at 5:00 PM every day, 180 180 00:07:19,800 --> 00:07:23,340 which coincidentally is when we ran trickster.exe. 181 181 00:07:23,340 --> 00:07:24,510 And after it's triggered, 182 182 00:07:24,510 --> 00:07:28,260 it's going to happen every three minutes for one day. 183 183 00:07:28,260 --> 00:07:30,330 So every three minutes for the next 24 hours, 184 184 00:07:30,330 --> 00:07:33,330 it's going to keep doing this program. 185 185 00:07:33,330 --> 00:07:35,160 And what is it going to do? 186 186 00:07:35,160 --> 00:07:39,360 Well, it's going to start this program, this u.exe program. 187 187 00:07:39,360 --> 00:07:41,820 Now we don't know what u.exe does yet, 188 188 00:07:41,820 --> 00:07:43,680 but we do know that Trickster wants it 189 189 00:07:43,680 --> 00:07:46,050 to run every three minutes. 190 190 00:07:46,050 --> 00:07:48,690 So if you had to venture a guess as to what the function of 191 191 00:07:48,690 --> 00:07:51,600 this program is, what do you think it would be? 192 192 00:07:51,600 --> 00:07:53,370 I think it's probably a beacon. 193 193 00:07:53,370 --> 00:07:55,860 It's probably calling out to a command and control server 194 194 00:07:55,860 --> 00:07:58,380 and saying, "Hey, I've infected this machine. 195 195 00:07:58,380 --> 00:08:00,390 I'm here and I'm ready for orders." 196 196 00:08:00,390 --> 00:08:01,650 That's what I think this is doing, 197 197 00:08:01,650 --> 00:08:03,270 but we'll look into that as we go through 198 198 00:08:03,270 --> 00:08:06,450 and try to prove our thoughts on this. 199 199 00:08:06,450 --> 00:08:09,180 Next, we can look at the conditions and you can see that it 200 200 00:08:09,180 --> 00:08:11,010 will start all the time. 201 201 00:08:11,010 --> 00:08:14,250 It will only stop if the computer ceases to be idle. 202 202 00:08:14,250 --> 00:08:16,170 And we can look at our settings here. 203 203 00:08:16,170 --> 00:08:18,510 It's going to be a task that's run on demand. 204 204 00:08:18,510 --> 00:08:20,850 It's going to run it as soon as possible. 205 205 00:08:20,850 --> 00:08:22,140 And we can see the history. 206 206 00:08:22,140 --> 00:08:23,670 Has it happened yet? 207 207 00:08:23,670 --> 00:08:25,980 Well, not really because the history was disabled here. 208 208 00:08:25,980 --> 00:08:27,330 There is no logging. 209 209 00:08:27,330 --> 00:08:29,700 But on a good system in an enterprise network, 210 210 00:08:29,700 --> 00:08:31,260 you may have this enabled and be able 211 211 00:08:31,260 --> 00:08:34,710 to see all the times that it ran, but since we don't, 212 212 00:08:34,710 --> 00:08:36,930 we're going to go ahead and look at this system 213 213 00:08:36,930 --> 00:08:39,000 and see if we can figure it out. 214 214 00:08:39,000 --> 00:08:40,650 And so we can see that the next time 215 215 00:08:40,650 --> 00:08:43,383 this is going to run is in just about a minute. 216 216 00:08:44,670 --> 00:08:46,170 Now, if we sit here for a minute, 217 217 00:08:46,170 --> 00:08:48,120 we're not going to see anything because 218 218 00:08:48,120 --> 00:08:50,490 this program is run in the background. 219 219 00:08:50,490 --> 00:08:53,700 This program is run as a beacon and that's just going to run 220 220 00:08:53,700 --> 00:08:54,927 where we can't even see it. 221 221 00:08:54,927 --> 00:08:57,150 And so we're going to have to look at something like a process 222 222 00:08:57,150 --> 00:08:59,580 explorer or be able to see the network traffic 223 223 00:08:59,580 --> 00:09:01,530 and see that call out occur. 224 224 00:09:01,530 --> 00:09:04,560 We're going to use a program to see that call out happen 225 225 00:09:04,560 --> 00:09:08,010 and prove if this is or is not a beacon. 226 226 00:09:08,010 --> 00:09:12,780 Now, if you remember, we had a file, that u.exe, 227 227 00:09:12,780 --> 00:09:14,580 that was being run on our machine. 228 228 00:09:14,580 --> 00:09:16,800 It is located under the C drive, 229 229 00:09:16,800 --> 00:09:19,020 and then under the user drive, 230 230 00:09:19,020 --> 00:09:21,210 under our user account of IE user, 231 231 00:09:21,210 --> 00:09:25,380 under app data, under roaming, and then under winamp. 232 232 00:09:25,380 --> 00:09:27,090 And you'll see, there it is. 233 233 00:09:27,090 --> 00:09:29,130 Now, there are three other things here, 234 234 00:09:29,130 --> 00:09:31,590 one folder and two files. 235 235 00:09:31,590 --> 00:09:33,990 Let's see if there's anything inside this module's folder. 236 236 00:09:33,990 --> 00:09:35,340 Well, there isn't yet. 237 237 00:09:35,340 --> 00:09:38,430 And the reason why is the stage one malware, 238 238 00:09:38,430 --> 00:09:42,720 this us.exe file, has been making its call out, 239 239 00:09:42,720 --> 00:09:44,370 but we stopped it before it ever had 240 240 00:09:44,370 --> 00:09:47,850 a chance to download any modules or malware, and really, 241 241 00:09:47,850 --> 00:09:49,800 the reason why is because the IP addresses 242 242 00:09:49,800 --> 00:09:51,330 it's calling to are benign. 243 243 00:09:51,330 --> 00:09:52,560 They are not malicious. 244 244 00:09:52,560 --> 00:09:55,560 But if this was a real piece of malware that was dangerous, 245 245 00:09:55,560 --> 00:09:58,350 it could be calling out and downloading that stuff into 246 246 00:09:58,350 --> 00:10:02,040 these modules and running that stage two malware to make it 247 247 00:10:02,040 --> 00:10:04,380 part of a botnet, or steal your files, 248 248 00:10:04,380 --> 00:10:05,550 or conduct ransomware, 249 249 00:10:05,550 --> 00:10:09,210 or whatever its decided method would be. 250 250 00:10:09,210 --> 00:10:14,210 Next, it has two text files here, client ID and group tag. 251 251 00:10:14,460 --> 00:10:16,980 And I'm going to open up client ID first and we're going to go 252 252 00:10:16,980 --> 00:10:19,503 ahead and open this with Notepad. 253 253 00:10:20,400 --> 00:10:25,400 Now, the client ID here, this is my host name, MSEdgeWin10. 254 254 00:10:25,770 --> 00:10:27,480 What is all of this behind it? 255 255 00:10:27,480 --> 00:10:31,230 Well, this becomes a unique identifier or a serial number, 256 256 00:10:31,230 --> 00:10:32,520 and that's what this malware is doing. 257 257 00:10:32,520 --> 00:10:36,360 It is going to be connecting to all of these machines and try 258 258 00:10:36,360 --> 00:10:38,040 to do something with that information. 259 259 00:10:38,040 --> 00:10:39,300 If it's putting 'em in a botnet, 260 260 00:10:39,300 --> 00:10:41,130 it needs to know what machines are what. 261 261 00:10:41,130 --> 00:10:42,270 If it's going to do ransomware, 262 262 00:10:42,270 --> 00:10:44,730 it needs to know who you are so that when you pay them, 263 263 00:10:44,730 --> 00:10:47,010 they can release your machine or not, 264 264 00:10:47,010 --> 00:10:49,260 depending on how the attacker's going to do their job. 265 265 00:10:49,260 --> 00:10:50,970 But again, they need a way to identify you, 266 266 00:10:50,970 --> 00:10:52,560 and that's what this client ID is. 267 267 00:10:52,560 --> 00:10:54,750 It's just simply a serial number. 268 268 00:10:54,750 --> 00:10:56,250 Next, we have this group tag. 269 269 00:10:56,250 --> 00:10:58,980 And if we open up the group tag in Notepad, 270 270 00:10:58,980 --> 00:11:02,640 we can see it just says TT0002, 271 271 00:11:02,640 --> 00:11:06,090 which is just an alpha numeric code for this group 272 272 00:11:06,090 --> 00:11:08,010 that your machine is being put into. 273 273 00:11:08,010 --> 00:11:09,870 And again, if you're going to be part of a botnet, 274 274 00:11:09,870 --> 00:11:12,360 maybe I want to be able to sell off 100 machines, 275 275 00:11:12,360 --> 00:11:15,630 or 1,000 machines, or 10,000 machines at a time 276 276 00:11:15,630 --> 00:11:18,120 to conduct a DDOS attack. 277 277 00:11:18,120 --> 00:11:20,040 Well, I need a way to group those together, 278 278 00:11:20,040 --> 00:11:22,440 and this group tag is simply that. 279 279 00:11:22,440 --> 00:11:24,780 So, those are those two files and the module 280 280 00:11:24,780 --> 00:11:27,630 and that's what it did onto our hard drive, 281 281 00:11:27,630 --> 00:11:29,640 but it really hasn't done anything malicious yet because 282 282 00:11:29,640 --> 00:11:31,890 this is just the stage one dropper. 283 283 00:11:31,890 --> 00:11:34,170 Now you can see how we might be going down 284 284 00:11:34,170 --> 00:11:36,210 all the way through and digging really, 285 285 00:11:36,210 --> 00:11:38,640 really deep into this malware to figure out exactly what 286 286 00:11:38,640 --> 00:11:40,350 it's doing and how it's doing it. 287 287 00:11:40,350 --> 00:11:41,580 And you can keep following these 288 288 00:11:41,580 --> 00:11:44,280 breadcrumbs all the way down, but at this point, 289 289 00:11:44,280 --> 00:11:47,580 we already have three different indicators of compromise. 290 290 00:11:47,580 --> 00:11:50,790 The first would be the file hash for trickster.exe, 291 291 00:11:50,790 --> 00:11:52,710 the second would be the fact that it goes 292 292 00:11:52,710 --> 00:11:56,130 and creates this process, this executable, 293 293 00:11:56,130 --> 00:11:58,560 this u.exe file and places it 294 294 00:11:58,560 --> 00:12:01,290 in the roaming winamp directory. 295 295 00:12:01,290 --> 00:12:03,720 Another one is the fact that it creates this client ID and 296 296 00:12:03,720 --> 00:12:06,270 this group tag and this modules folder. 297 297 00:12:06,270 --> 00:12:08,010 So we already have three right there. 298 298 00:12:08,010 --> 00:12:09,690 But if we want to dig deeper, 299 299 00:12:09,690 --> 00:12:11,730 we can actually start digging into this 300 300 00:12:11,730 --> 00:12:13,560 further, and further, and further. 301 301 00:12:13,560 --> 00:12:15,420 So now that we've done the dynamic analysis 302 302 00:12:15,420 --> 00:12:17,880 and figured out that this is a stage one dropper, 303 303 00:12:17,880 --> 00:12:20,070 that it's beaconing out every three minutes, 304 304 00:12:20,070 --> 00:12:22,590 and that it's calling out to this particular IP address 305 305 00:12:22,590 --> 00:12:25,650 and it's creating this client ID and this group tag, 306 306 00:12:25,650 --> 00:12:29,160 let's go and look at it statically and dig just a little bit 307 307 00:12:29,160 --> 00:12:30,690 deeper to figure out what else 308 308 00:12:30,690 --> 00:12:33,450 we can determine inside of Trickster. 309 309 00:12:33,450 --> 00:12:35,490 So now that we've kind of exhausted 310 310 00:12:35,490 --> 00:12:37,170 what we can do dynamically, 311 311 00:12:37,170 --> 00:12:40,200 we're going to dig back into static analysis just a little bit. 312 312 00:12:40,200 --> 00:12:43,080 So the way we're going to do this is by opening up the 313 313 00:12:43,080 --> 00:12:46,620 u.exe file in a program called IDA. 314 314 00:12:46,620 --> 00:12:50,100 Now, IDA is a decompiler and we can find it here inside of 315 315 00:12:50,100 --> 00:12:53,340 Flair and then into Disassemblers. 316 316 00:12:54,540 --> 00:12:57,210 Now this decompiler we're going to open up is IDA Free, 317 317 00:12:57,210 --> 00:12:59,970 which is the freeware version of IDA Pro. 318 318 00:12:59,970 --> 00:13:01,770 It's going to allow us to do quite a bit 319 319 00:13:01,770 --> 00:13:04,650 and we're only going to use a very little bit about it. 320 320 00:13:04,650 --> 00:13:08,280 So what we're going to do is we're going to disassemble a new file 321 321 00:13:08,280 --> 00:13:11,010 and all we have to do here is drag it 322 322 00:13:11,010 --> 00:13:12,410 on here to disassemble it. 323 323 00:13:12,410 --> 00:13:16,200 So I'm going to bring back up that file, u.exe, 324 324 00:13:16,200 --> 00:13:18,630 and drag it and drop it onto IDA. 325 325 00:13:18,630 --> 00:13:20,940 So, we're going to load it up and we have to choose, 326 326 00:13:20,940 --> 00:13:24,390 is it an executable from DOSS, a portable executable, 327 327 00:13:24,390 --> 00:13:25,890 or a binary file? 328 328 00:13:25,890 --> 00:13:26,723 In our case, 329 329 00:13:26,723 --> 00:13:29,520 I believe it to be a portable executable because it's 330 330 00:13:29,520 --> 00:13:32,220 running inside of Windows and not inside of DOSS 331 331 00:13:32,220 --> 00:13:33,420 as we saw from that comment 332 332 00:13:33,420 --> 00:13:36,090 we pulled out using the Floss tool. 333 333 00:13:36,090 --> 00:13:38,190 So we're just going to go ahead and hit okay. 334 334 00:13:40,110 --> 00:13:41,820 And up it's going to pop. 335 335 00:13:41,820 --> 00:13:44,700 Now, if you notice here in IDA view A on the left side, 336 336 00:13:44,700 --> 00:13:48,630 it's going through and giving us the assembly code for this 337 337 00:13:48,630 --> 00:13:51,390 program the best it can based on 338 338 00:13:51,390 --> 00:13:54,660 decompiling it and making its best guesses. 339 339 00:13:54,660 --> 00:13:56,910 Now, what we really care about here in IDA though 340 340 00:13:56,910 --> 00:14:00,180 is what imports and exports is this thing using. 341 341 00:14:00,180 --> 00:14:02,400 So I'm going to go ahead and hit exports 342 342 00:14:02,400 --> 00:14:03,630 and we really don't see anything. 343 343 00:14:03,630 --> 00:14:05,760 If I go ahead and hit imports, 344 344 00:14:05,760 --> 00:14:09,180 you can see all of the different processes and functions 345 345 00:14:09,180 --> 00:14:11,760 that are called from the kernel 346 346 00:14:11,760 --> 00:14:13,560 and from the APIs in Windows. 347 347 00:14:13,560 --> 00:14:16,710 And so here we have our imports and we can see the different 348 348 00:14:16,710 --> 00:14:19,320 types of functions that this program calls. 349 349 00:14:19,320 --> 00:14:20,153 For instance, 350 350 00:14:20,153 --> 00:14:23,520 it opens and closes registry keys and queries them. 351 351 00:14:23,520 --> 00:14:25,290 And we notice that in process monitor 352 352 00:14:25,290 --> 00:14:27,510 that it did a lot of things with the registry. 353 353 00:14:27,510 --> 00:14:29,580 We can see the fact that it can create files 354 354 00:14:29,580 --> 00:14:31,170 or get a current directory. 355 355 00:14:31,170 --> 00:14:34,350 It can get command line arguments and run commands. 356 356 00:14:34,350 --> 00:14:37,020 It can load strings, it can register classes, 357 357 00:14:37,020 --> 00:14:39,420 it can do all sorts of different things. 358 358 00:14:39,420 --> 00:14:41,070 And as we scroll through this, 359 359 00:14:41,070 --> 00:14:43,740 we can learn a little bit about the program and what it's 360 360 00:14:43,740 --> 00:14:47,100 capable of doing just by looking through the different 361 361 00:14:47,100 --> 00:14:50,040 processes that it may be able to run. 362 362 00:14:50,040 --> 00:14:51,930 Now, that gives us some information, 363 363 00:14:51,930 --> 00:14:54,420 but it doesn't give us a whole lot to go on. 364 364 00:14:54,420 --> 00:14:57,630 So unless you're able to actually read these assembly 365 365 00:14:57,630 --> 00:15:01,350 language programs and be able to go through it step-by-step, 366 366 00:15:01,350 --> 00:15:03,690 this is not really going to help us for an 367 367 00:15:03,690 --> 00:15:06,390 introductory level malware analysis. 368 368 00:15:06,390 --> 00:15:07,380 Now, if you want to go through it and 369 369 00:15:07,380 --> 00:15:09,990 reverse engineer this entire thing, well, 370 370 00:15:09,990 --> 00:15:11,730 you're going to have to go through a different class 371 371 00:15:11,730 --> 00:15:13,440 because that is way, 372 372 00:15:13,440 --> 00:15:16,410 way more in depth than this class is going to be looking at. 373 373 00:15:16,410 --> 00:15:18,870 Now let's go ahead and close out of IDA 374 374 00:15:18,870 --> 00:15:21,480 and we'll go ahead and just say okay. 375 375 00:15:21,480 --> 00:15:24,450 And what we're going to look at here is we are going to take 376 376 00:15:24,450 --> 00:15:29,450 this program, u.exe, and run it through a debugger. 377 377 00:15:29,460 --> 00:15:33,210 Now a debugger allows us to run a program step by step, 378 378 00:15:33,210 --> 00:15:36,180 one instruction at a time as it goes through. 379 379 00:15:36,180 --> 00:15:37,890 So we're just going to just go ahead and say yes here. 380 380 00:15:37,890 --> 00:15:39,450 And yes. 381 381 00:15:39,450 --> 00:15:41,190 Now what I want to do is I want to 382 382 00:15:41,190 --> 00:15:46,190 open up our file inside of AliDebug. 383 383 00:15:46,920 --> 00:15:49,923 And to do that, I'm just going to go in here to the C drive, 384 384 00:15:50,850 --> 00:15:55,850 going to go down to users, ieuser, app data, roaming, 385 385 00:15:56,280 --> 00:16:01,083 and then down to the bottom for winapp and there is u.exe. 386 386 00:16:02,250 --> 00:16:06,330 Once we open that up here, you can see, just like before, 387 387 00:16:06,330 --> 00:16:09,450 we have all of our assembly language here as best as this 388 388 00:16:09,450 --> 00:16:14,160 can decompile and run it through step by step. 389 389 00:16:14,160 --> 00:16:17,820 Now, a lot of malware is going to protect itself 390 390 00:16:17,820 --> 00:16:19,530 from being run step by step. 391 391 00:16:19,530 --> 00:16:22,290 Let's find out if Trickster and u.exe 392 392 00:16:22,290 --> 00:16:24,540 is one of those pieces of malware. 393 393 00:16:24,540 --> 00:16:26,290 So what we are going to do is we are 394 394 00:16:26,290 --> 00:16:28,620 going to go ahead and play it. 395 395 00:16:28,620 --> 00:16:31,290 And if you see the little play icon right here, 396 396 00:16:31,290 --> 00:16:33,633 it's going to go through, and just say yes, 397 397 00:16:34,920 --> 00:16:36,630 it goes through and attempts to play 398 398 00:16:36,630 --> 00:16:38,733 this program step by step. 399 399 00:16:40,260 --> 00:16:41,280 Now, when we do it, 400 400 00:16:41,280 --> 00:16:43,680 it runs very quickly and then it just terminates. 401 401 00:16:43,680 --> 00:16:45,780 Nothing really happened for us, right? 402 402 00:16:45,780 --> 00:16:49,590 Well, that means that this piece of malware most likely is 403 403 00:16:49,590 --> 00:16:50,940 detecting the fact that it's in 404 404 00:16:50,940 --> 00:16:53,910 a debugger and going step by step. 405 405 00:16:53,910 --> 00:16:56,790 And so we're going to have to use a little bit more complex 406 406 00:16:56,790 --> 00:16:59,310 method to be able to pull out that code 407 407 00:16:59,310 --> 00:17:02,160 and then analyze it in our static analysis. 408 408 00:17:02,160 --> 00:17:04,710 We saw that it was encrypted when we tried to run Floss 409 409 00:17:04,710 --> 00:17:08,040 earlier on and now when we try to run it through a debugger, 410 410 00:17:08,040 --> 00:17:11,340 we are actually getting it where it stops immediately. 411 411 00:17:11,340 --> 00:17:12,690 So it's detecting the fact that it's 412 412 00:17:12,690 --> 00:17:14,400 being stepped through the program. 413 413 00:17:14,400 --> 00:17:15,660 So instead what we're going to have to do 414 414 00:17:15,660 --> 00:17:17,940 is we're going to have to run the process, 415 415 00:17:17,940 --> 00:17:21,210 capture it in memory while it's being unpacked, 416 416 00:17:21,210 --> 00:17:23,100 and then be able to analyze it. 417 417 00:17:23,100 --> 00:17:27,060 Now, to do that, we have to start with a clean VM again. 418 418 00:17:27,060 --> 00:17:29,610 And so what I'm going to do here is I'm going to pause this and 419 419 00:17:29,610 --> 00:17:32,190 bring ourself back up to a clean VM 420 420 00:17:32,190 --> 00:17:34,290 with our antivirus turned off, 421 421 00:17:34,290 --> 00:17:36,000 our firewall turned off, 422 422 00:17:36,000 --> 00:17:39,330 and Trickster expanded onto the desktop. 423 423 00:17:39,330 --> 00:17:42,990 So, we are back and we now have our flare VM 424 424 00:17:42,990 --> 00:17:45,240 and we should have our antivirus off, 425 425 00:17:45,240 --> 00:17:46,830 we have our firewall off, 426 426 00:17:46,830 --> 00:17:49,890 and we've unzipped the Trickster file. 427 427 00:17:49,890 --> 00:17:51,360 But before we move any further, 428 428 00:17:51,360 --> 00:17:55,530 we need to download a piece of software called Process Dump. 429 429 00:17:55,530 --> 00:17:59,070 So we're going to go ahead and open up our Edge browser, 430 430 00:17:59,070 --> 00:18:00,180 and from our Edge browser, 431 431 00:18:00,180 --> 00:18:05,180 we want to go to split-code.com/processdump.html. 432 432 00:18:06,780 --> 00:18:11,780 That's split-code.com/processdump.html. 433 433 00:18:11,940 --> 00:18:13,260 And when we go there, 434 434 00:18:13,260 --> 00:18:16,800 you are going to be able to download the Process Dump file, 435 435 00:18:16,800 --> 00:18:21,660 which currently is version 2.1 for Windows 32 or 64-bit. 436 436 00:18:21,660 --> 00:18:24,390 And since we're operating on a 64-bit operating system, 437 437 00:18:24,390 --> 00:18:26,100 that will work fine for us. 438 438 00:18:26,100 --> 00:18:27,750 We're going to go ahead and hit open 439 439 00:18:29,010 --> 00:18:31,080 and it's going to open it here on our desktop 440 440 00:18:31,080 --> 00:18:35,070 and we're going to take PD64 and drop it onto our desktop 441 441 00:18:35,070 --> 00:18:37,110 so it's ready for us to use. 442 442 00:18:37,110 --> 00:18:39,480 And we can go ahead and close our Edge browser. 443 443 00:18:39,480 --> 00:18:41,940 So now that we have PD64 on the desktop, 444 444 00:18:41,940 --> 00:18:45,000 we want to go ahead and open up a command prompt, 445 445 00:18:45,000 --> 00:18:46,770 but I want to right-click on it this time 446 446 00:18:46,770 --> 00:18:48,901 and run it as administrator. 447 447 00:18:48,901 --> 00:18:50,340 So go ahead and say yes. 448 448 00:18:50,340 --> 00:18:51,810 So now that we have our command prompt 449 449 00:18:51,810 --> 00:18:53,520 open as an administrator, 450 450 00:18:53,520 --> 00:18:57,360 we want to get into the directory that is our desktop, 451 451 00:18:57,360 --> 00:19:02,360 which is going to be under C:/users/ieuser/desktop. 452 452 00:19:05,397 --> 00:19:06,930 And if we hit DIR, 453 453 00:19:06,930 --> 00:19:09,360 you can see Trickster and PD64 454 454 00:19:09,360 --> 00:19:11,460 are sitting there on the desktop. 455 455 00:19:11,460 --> 00:19:16,460 So now, I want to go ahead and run PD64 and create a hash 456 456 00:19:17,460 --> 00:19:21,510 database of all of the processes that are currently running 457 457 00:19:21,510 --> 00:19:23,610 before I put any malware in there. 458 458 00:19:23,610 --> 00:19:28,610 So I'm going to do that by doing PD64.exe-DB for database, 459 459 00:19:30,060 --> 00:19:34,320 space gen, or G-E-N for generate. 460 460 00:19:34,320 --> 00:19:35,730 And then go ahead and hit enter. 461 461 00:19:35,730 --> 00:19:39,960 Now this is going to go through and find all of the processes 462 462 00:19:39,960 --> 00:19:43,590 that are sitting there on this system and it's going to capture 463 463 00:19:43,590 --> 00:19:46,110 them and create a good hash value 464 464 00:19:46,110 --> 00:19:48,330 for all of those processes. 465 465 00:19:48,330 --> 00:19:50,850 Now this is going to take somewhere around five to 10 minutes, 466 466 00:19:50,850 --> 00:19:53,100 depending on how fast your system is. 467 467 00:19:53,100 --> 00:19:56,190 And so I'm going to go ahead and pause the video here and come 468 468 00:19:56,190 --> 00:19:59,310 back once that hash database has been created. 469 469 00:19:59,310 --> 00:20:02,520 Then, we're going to be able to go and run Trickster 470 470 00:20:02,520 --> 00:20:04,947 and capture that malicious process 471 471 00:20:04,947 --> 00:20:08,343 and dump it and then look at it inside of IDA. 472 472 00:20:09,630 --> 00:20:11,940 Now, once the program is done, 473 473 00:20:11,940 --> 00:20:13,410 you're going to get this finished, 474 474 00:20:13,410 --> 00:20:16,320 the clean hash database has now been created. 475 475 00:20:16,320 --> 00:20:19,050 And you'll notice here on your desktop you have the clean 476 476 00:20:19,050 --> 00:20:23,700 hashes file that is going to serve as that database. 477 477 00:20:23,700 --> 00:20:26,550 The next step to capture Trickster 478 478 00:20:26,550 --> 00:20:29,547 is to type in the command PD64.exe-P 479 479 00:20:33,600 --> 00:20:36,000 and then the name of the file that's going to be running, 480 480 00:20:36,000 --> 00:20:37,950 which is trickster.exe. 481 481 00:20:37,950 --> 00:20:40,050 But don't hit enter just yet. 482 482 00:20:40,050 --> 00:20:42,300 We have to go and create Trickster first 483 483 00:20:42,300 --> 00:20:44,610 because if I try to hit enter right now, 484 484 00:20:44,610 --> 00:20:46,500 it's not going to find anything because 485 485 00:20:46,500 --> 00:20:48,150 Trickster doesn't exist. 486 486 00:20:48,150 --> 00:20:50,220 So I'm going to get it ready to go, 487 487 00:20:50,220 --> 00:20:54,000 right-click on Trickster, tell it to run as admin. 488 488 00:20:54,000 --> 00:20:55,680 Then as soon as I hit yes, 489 489 00:20:55,680 --> 00:20:58,710 I'm going to click on the command prompt and hit enter 490 490 00:20:58,710 --> 00:21:00,450 to capture that process. 491 491 00:21:00,450 --> 00:21:02,400 So yes, click, enter. 492 492 00:21:02,400 --> 00:21:07,400 And you'll see here that it is dumping that exe file to the 493 493 00:21:07,440 --> 00:21:12,440 file tricksterexepidedtricksterexe, 494 494 00:21:12,570 --> 00:21:15,330 this big, long file name right here. 495 495 00:21:15,330 --> 00:21:18,690 And as you can see, that is now on the desktop, 496 496 00:21:18,690 --> 00:21:20,730 which is that piece of malware 497 497 00:21:20,730 --> 00:21:23,640 unpacked and straight from memory. 498 498 00:21:23,640 --> 00:21:27,900 So, the next step is to open this up in IDA again. 499 499 00:21:27,900 --> 00:21:31,200 So we're going to go ahead and go to our Windows icon, 500 500 00:21:31,200 --> 00:21:34,680 type in I-D-A and IDA should show up. 501 501 00:21:34,680 --> 00:21:36,390 We'll open that up, 502 502 00:21:36,390 --> 00:21:38,460 tell it we don't need the information displayed, 503 503 00:21:38,460 --> 00:21:41,763 agree to the terms and conditions, and tell it new. 504 504 00:21:42,810 --> 00:21:45,510 And we'll go ahead and hit cancel. 505 505 00:21:45,510 --> 00:21:50,070 Then we need to go ahead and get the file from the desktop, 506 506 00:21:50,070 --> 00:21:52,710 that trickster.exe file, 507 507 00:21:52,710 --> 00:21:54,180 that new one that we just dumped, 508 508 00:21:54,180 --> 00:21:56,190 and drop it into IDA. 509 509 00:21:56,190 --> 00:21:59,790 Go ahead and hit okay and okay. 510 510 00:21:59,790 --> 00:22:03,120 And now we have that file we just captured from memory, 511 511 00:22:03,120 --> 00:22:04,920 that we dumped from that process, 512 512 00:22:04,920 --> 00:22:06,690 and we can start looking at it 513 513 00:22:06,690 --> 00:22:09,780 to see if there's anything of interest to us. 514 514 00:22:09,780 --> 00:22:11,700 This should be a little bit more fruitful 515 515 00:22:11,700 --> 00:22:13,850 than the first time we looked at it in IDA. 516 516 00:22:16,830 --> 00:22:20,613 So let's go ahead and look at our imports one more time. 517 517 00:22:22,320 --> 00:22:24,600 Now, we have a couple of new ones here 518 518 00:22:24,600 --> 00:22:26,310 that we didn't have last time, 519 519 00:22:26,310 --> 00:22:29,910 namely the sleep and the get tick count. 520 520 00:22:29,910 --> 00:22:32,190 Now, what do these do? 521 521 00:22:32,190 --> 00:22:36,030 Well, get tick count is counting the processes. 522 522 00:22:36,030 --> 00:22:37,920 It's basically a clock. 523 523 00:22:37,920 --> 00:22:39,600 And then there's this sleep function. 524 524 00:22:39,600 --> 00:22:41,190 Now what is that doing? 525 525 00:22:41,190 --> 00:22:43,170 Well, let's go ahead and double-click on sleep. 526 526 00:22:43,170 --> 00:22:47,280 We see that we have this sleep is going to happen for some 527 527 00:22:47,280 --> 00:22:49,200 amount of milliseconds. 528 528 00:22:49,200 --> 00:22:51,000 And if I go ahead and look at this, 529 529 00:22:51,000 --> 00:22:54,930 I can see here it says push1388H, 530 530 00:22:54,930 --> 00:22:58,620 which is the amount of milliseconds that it's going to wait 531 531 00:22:58,620 --> 00:23:00,060 as it's sleeping. 532 532 00:23:00,060 --> 00:23:01,770 Now what does that equate to? 533 533 00:23:01,770 --> 00:23:04,110 Well, that equates to five seconds. 534 534 00:23:04,110 --> 00:23:07,440 Now, why might it be waiting five seconds? 535 535 00:23:07,440 --> 00:23:09,660 Well, if we start walking through this program, 536 536 00:23:09,660 --> 00:23:12,840 you're going to see that the reason it is sleeping for five 537 537 00:23:12,840 --> 00:23:14,640 seconds and using that tick count 538 538 00:23:14,640 --> 00:23:16,350 to figure out what time it is, 539 539 00:23:16,350 --> 00:23:20,850 is so that it has time to launch the program and then create 540 540 00:23:20,850 --> 00:23:24,510 the file and folder and copy in u.exe 541 541 00:23:24,510 --> 00:23:28,470 to the hard drive and then run u.exe. 542 542 00:23:28,470 --> 00:23:30,480 That's what these calls are there for. 543 543 00:23:30,480 --> 00:23:33,450 So it starts, it waits, it creates the folder, 544 544 00:23:33,450 --> 00:23:36,300 it waits, it runs the program, it waits. 545 545 00:23:36,300 --> 00:23:37,740 That's the idea here. 546 546 00:23:37,740 --> 00:23:39,720 So those are two new functions. 547 547 00:23:39,720 --> 00:23:41,640 Now, why does it do that? 548 548 00:23:41,640 --> 00:23:45,090 The reason why is because it is doing this as a way to 549 549 00:23:45,090 --> 00:23:48,600 detect if things are ready for the next step. 550 550 00:23:48,600 --> 00:23:51,600 And so you can see, if you can read assembly code, 551 551 00:23:51,600 --> 00:23:52,680 as you go through here, 552 552 00:23:52,680 --> 00:23:53,940 all of the things that this 553 553 00:23:53,940 --> 00:23:56,190 particular piece of malware does. 554 554 00:23:56,190 --> 00:23:57,023 Now, again, 555 555 00:23:57,023 --> 00:23:59,400 we're not going to go through and dig into 556 556 00:23:59,400 --> 00:24:01,350 every single line of this code. 557 557 00:24:01,350 --> 00:24:04,470 It's just too much and too in depth for this course. 558 558 00:24:04,470 --> 00:24:06,810 This is not a class on assembly language 559 559 00:24:06,810 --> 00:24:09,270 or malware reverse engineering. 560 560 00:24:09,270 --> 00:24:11,220 But I just wanted to give you an idea of the type of 561 561 00:24:11,220 --> 00:24:14,940 information that you can find by process dumping this and 562 562 00:24:14,940 --> 00:24:18,123 loading it up into IDA doing a very cursory search. 563 563 00:24:19,410 --> 00:24:20,243 So again, 564 564 00:24:20,243 --> 00:24:23,370 this class is not designed to have you dig through this 565 565 00:24:23,370 --> 00:24:26,580 static analysis and learn every single piece about this 566 566 00:24:26,580 --> 00:24:28,890 program and how to reverse engineer it. 567 567 00:24:28,890 --> 00:24:29,723 Instead, 568 568 00:24:29,723 --> 00:24:32,400 I just wanted to give you a couple of quick tidbits so that 569 569 00:24:32,400 --> 00:24:35,640 you can kind of wet your appetite if you want to go down 570 570 00:24:35,640 --> 00:24:38,610 this malware reverse engineering route and really start 571 571 00:24:38,610 --> 00:24:42,030 digging into assembly code and how these things work. 572 572 00:24:42,030 --> 00:24:45,630 This is just to give you a little bit of exposure to it, 573 573 00:24:45,630 --> 00:24:48,060 not to make you an expert. 574 574 00:24:48,060 --> 00:24:51,480 Wow, I know that was a long video and that was a ton of 575 575 00:24:51,480 --> 00:24:53,790 information that was way in depth. 576 576 00:24:53,790 --> 00:24:55,860 Now the good news is for the exam, 577 577 00:24:55,860 --> 00:24:57,990 you do not need to know how to do everything 578 578 00:24:57,990 --> 00:24:59,820 I just walked through in this video. 579 579 00:24:59,820 --> 00:25:00,653 Instead, 580 580 00:25:00,653 --> 00:25:02,970 I was doing it just to give you an introduction so you could 581 581 00:25:02,970 --> 00:25:05,400 see how this stuff works and start putting some of these 582 582 00:25:05,400 --> 00:25:07,440 pieces together early in the course. 583 583 00:25:07,440 --> 00:25:09,090 Now, as we go through the rest of this course, 584 584 00:25:09,090 --> 00:25:11,370 we're going to dive deeper into a lot of these different 585 585 00:25:11,370 --> 00:25:13,200 concepts as we talk about indicators 586 586 00:25:13,200 --> 00:25:14,640 of compromise on the network, 587 587 00:25:14,640 --> 00:25:16,200 as we talk about indicators of compromise 588 588 00:25:16,200 --> 00:25:17,130 from the file system, 589 589 00:25:17,130 --> 00:25:19,230 as we talk about persistence like we saw with 590 590 00:25:19,230 --> 00:25:21,630 the scheduled tasks, and things like that. 591 591 00:25:21,630 --> 00:25:23,520 So this is just to give you a good overview 592 592 00:25:23,520 --> 00:25:26,040 and then we're going to dig deeper into each of those areas. 593 593 00:25:26,040 --> 00:25:28,380 And you'll really be answering multiple choice questions on 594 594 00:25:28,380 --> 00:25:31,200 the exam about these concepts as opposed to having to 595 595 00:25:31,200 --> 00:25:34,140 actually do the physical work of analyzing every single 596 596 00:25:34,140 --> 00:25:36,993 piece of this malware like I was doing inside this video.